@oneuptime/common 12.0.6 → 12.0.7

package/Server/Services/StatusPageDomainService.ts

@@ -1,18 +1,17 @@
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import GreenlockUtil from "../Utils/Greenlock/Greenlock";
 import logger, { LogAttributes } from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import DomainService from "./DomainService";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../Types/API/HTTPResponse";
-import URL from "../../Types/API/URL";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
-import API from "../../Utils/API";
 import AcmeCertificate from "../../Models/DatabaseModels/AcmeCertificate";
 import DomainModel from "../../Models/DatabaseModels/Domain";
 import StatusPageDomain from "../../Models/DatabaseModels/StatusPageDomain";
@@ -22,11 +21,60 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { StatusPageCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
 
+const STATUS_PAGE_DOMAIN_EGRESS_LABEL: string = "Status page domain";
+
 export class Service extends DatabaseService<StatusPageDomain> {
   public constructor() {
     super(StatusPageDomain);
   }
 
+  /*
+   * Normalize a submitted subdomain and reject anything that is not a plain
+   * DNS label chain.
+   *
+   * fullDomain is built as `${subdomain}.${baseDomain}` and then interpolated
+   * into "https://" + fullDomain + "/status-page-api/..." — and URL parsing
+   * treats everything before the first "/" as the host. Without this check a
+   * subdomain of "169.254.169.254/latest/meta-data/#" hands an attacker the
+   * host, the port and the path of a request the certificate cron then makes
+   * unattended, every 15 minutes, from inside the cluster.
+   */
+  private static normalizeAndValidateSubdomain(
+    subdomain: string | undefined,
+  ): string {
+    const normalized: string = subdomain?.trim().toLowerCase() || "";
+
+    // "@" is the documented way to ask for the root domain.
+    if (normalized === "" || normalized === "@") {
+      return "";
+    }
+
+    if (!Domain.isValidSubdomain(normalized)) {
+      throw new BadDataException(
+        `Subdomain ${normalized} is not valid. Use a plain subdomain such as "status" — schemes, ports, paths and "/" are not allowed.`,
+      );
+    }
+
+    return normalized;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<StatusPageDomain>,
+  ): Promise<OnUpdate<StatusPageDomain>> {
+    /*
+     * Create-time validation alone leaves the value editable afterwards —
+     * subdomain is ProjectMember-updatable.
+     */
+    if (updateBy.data.subdomain !== undefined) {
+      updateBy.data.subdomain = Service.normalizeAndValidateSubdomain(
+        updateBy.data.subdomain as string,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<StatusPageDomain>,
@@ -48,14 +96,11 @@ export class Service extends DatabaseService<StatusPageDomain> {
       );
     }
 
-    let normalizedSubdomain: string =
-      createBy.data.subdomain?.trim().toLowerCase() || "";
-
-    if (normalizedSubdomain === "@") {
-      normalizedSubdomain = "";
-    }
+    createBy.data.subdomain = Service.normalizeAndValidateSubdomain(
+      createBy.data.subdomain,
+    );
 
-    createBy.data.subdomain = normalizedSubdomain;
+    const normalizedSubdomain: string = createBy.data.subdomain;
 
     if (domain) {
       const baseDomain: string =
@@ -231,13 +276,13 @@ export class Service extends DatabaseService<StatusPageDomain> {
   ): Promise<boolean> {
     try {
       const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
-        await API.get({
-          url: URL.fromString(
+        await Domain.getForDomainVerification({
+          url:
             "https://" +
-              fulldomain +
-              "/status-page-api/cname-verification/" +
-              token,
-          ),
+            fulldomain +
+            "/status-page-api/cname-verification/" +
+            token,
+          targetLabel: STATUS_PAGE_DOMAIN_EGRESS_LABEL,
         });
 
       if (result.isFailure()) {
@@ -320,13 +365,13 @@ export class Service extends DatabaseService<StatusPageDomain> {
 
       try {
         const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
-          await API.get({
-            url: URL.fromString(
+          await Domain.getForDomainVerification({
+            url:
               "http://" +
-                fullDomain +
-                "/status-page-api/cname-verification/" +
-                token,
-            ),
+              fullDomain +
+              "/status-page-api/cname-verification/" +
+              token,
+            targetLabel: STATUS_PAGE_DOMAIN_EGRESS_LABEL,
           });
 
         logger.debug("CNAME verification result", {
@@ -353,13 +398,13 @@ export class Service extends DatabaseService<StatusPageDomain> {
 
       try {
         const resultHttps: HTTPErrorResponse | HTTPResponse<JSONObject> =
-          await API.get({
-            url: URL.fromString(
+          await Domain.getForDomainVerification({
+            url:
               "https://" +
-                fullDomain +
-                "/status-page-api/cname-verification/" +
-                token,
-            ),
+              fullDomain +
+              "/status-page-api/cname-verification/" +
+              token,
+            targetLabel: STATUS_PAGE_DOMAIN_EGRESS_LABEL,
           });
 
         logger.debug("CNAME verification result for https", {

package/Server/Services/TeamMemberService.ts

@@ -120,10 +120,40 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       }
     }
 
-    if (!createBy.props.isRoot) {
+    /*
+     * Only internal writes (isRoot) and a master admin acting from the Admin
+     * Dashboard may create a membership that is already accepted - that is the
+     * "accept the invitation automatically" checkbox on the admin invite forms.
+     *
+     * Everyone else invites, and the invited person accepts for themselves. A
+     * project admin who could accept on someone's behalf would be able to pull
+     * an account into their project - and into whatever the team's permissions
+     * grant - without that person ever agreeing to it.
+     */
+    const canCreateAcceptedInvitation: boolean = Boolean(
+      createBy.props.isRoot || createBy.props.isMasterAdmin,
+    );
+
+    if (!canCreateAcceptedInvitation) {
       createBy.data.hasAcceptedInvitation = false;
     }
 
+    const isInvitationAcceptedOnCreate: boolean = Boolean(
+      createBy.data.hasAcceptedInvitation,
+    );
+
+    /*
+     * The acceptance timestamp is stamped here rather than taken from the
+     * request, so it can never disagree with hasAcceptedInvitation - a row that
+     * says "Member" with no accepted-at date, or an accepted-at date on a row
+     * that is still only invited.
+     */
+    if (isInvitationAcceptedOnCreate) {
+      createBy.data.invitationAcceptedAt = OneUptimeDate.getCurrentDate();
+    } else {
+      delete createBy.data.invitationAcceptedAt;
+    }
+
     if (createBy.miscDataProps && createBy.miscDataProps["email"]) {
       const email: Email = new Email(createBy.miscDataProps["email"] as string);
 
@@ -221,10 +251,18 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
                 .addQueryParam("email", email.toString(), true)
                 .toString(),
               isNewUser: isNewUser.toString(),
+              /*
+               * An auto-accepted member has nothing left to accept, so the
+               * template drops the "sign in to accept your invitation" framing
+               * and tells them they are already in.
+               */
+              isInvitationAccepted: isInvitationAcceptedOnCreate.toString(),
               projectName: project.name!,
               homeUrl: new URL(httpProtocol, host).toString(),
             },
-            subject: "You have been invited to " + project.name,
+            subject: isInvitationAcceptedOnCreate
+              ? "You have been added to " + project.name
+              : "You have been invited to " + project.name,
           },
           {
             projectId: createBy.data.projectId!,
@@ -283,6 +321,65 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     );
   }
 
+  /*
+   * The per-project notification defaults a member gets the moment their
+   * membership becomes accepted, whether that happened by them accepting the
+   * invitation or by a master admin accepting it for them on create. Without
+   * these, an auto-accepted member is a member who is never notified about
+   * anything.
+   *
+   * Skipped for an unverified email: UserService adds the defaults for every
+   * accepted membership once the address is verified.
+   *
+   * Best effort. Both helpers below are idempotent, and by the time either
+   * caller runs, the membership row is already committed - failing the write
+   * that created it would report "invite failed" for a member who exists.
+   */
+  @CaptureSpan()
+  private async addDefaultNotificationSettingsAndRules(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+    user?: User | undefined;
+  }): Promise<void> {
+    try {
+      const user: User | null =
+        data.user ||
+        (await UserService.findOneById({
+          id: data.userId,
+          select: {
+            email: true,
+            isEmailVerified: true,
+          },
+          props: {
+            isRoot: true,
+          },
+        }));
+
+      if (!user || !user.isEmailVerified || !user.email) {
+        return;
+      }
+
+      await UserNotificationSettingService.addDefaultNotificationSettingsForUser(
+        data.userId,
+        data.projectId,
+      );
+
+      await UserNotificationRuleService.addDefaultNotificationRuleForUser(
+        data.projectId,
+        data.userId,
+        user.email,
+      );
+    } catch (err) {
+      logger.error(
+        err as Error,
+        {
+          projectId: data.projectId.toString(),
+          userId: data.userId.toString(),
+        } as LogAttributes,
+      );
+    }
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     onCreate: OnCreate<TeamMember>,
@@ -297,6 +394,18 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       onCreate.createBy.data.projectId!,
     );
 
+    /*
+     * A membership created already accepted never goes through the
+     * accept-invitation update, so it would otherwise miss the defaults that
+     * hook adds.
+     */
+    if (createdItem.hasAcceptedInvitation) {
+      await this.addDefaultNotificationSettingsAndRules({
+        userId: onCreate.createBy.data.userId!,
+        projectId: onCreate.createBy.data.projectId!,
+      });
+    }
+
     // Activation event for marketing funnels, attributed to the inviter.
     ProductAnalytics.captureForUser({
       userId: onCreate.createBy.props.userId,
@@ -339,16 +448,12 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     for (const item of items) {
       await this.refreshTokens(item.userId!, item.projectId!);
 
-      if (updateBy.data.hasAcceptedInvitation && item.user?.isEmailVerified) {
-        await UserNotificationSettingService.addDefaultNotificationSettingsForUser(
-          item.userId!,
-          item.projectId!,
-        );
-        await UserNotificationRuleService.addDefaultNotificationRuleForUser(
-          item.projectId!,
-          item.userId!,
-          item.user?.email as Email,
-        );
+      if (updateBy.data.hasAcceptedInvitation) {
+        await this.addDefaultNotificationSettingsAndRules({
+          userId: item.userId!,
+          projectId: item.projectId!,
+          user: item.user,
+        });
       }
     }
 

package/Server/Services/TelemetryIngestionKeyService.ts

@@ -85,6 +85,7 @@ export class Service extends DatabaseService<Model> {
 
     let secretKeyObjectId: ObjectID;
     try {
+      ObjectID.validateUUID(secretKey);
       secretKeyObjectId = new ObjectID(secretKey);
     } catch {
       this.projectIdCache.set(cacheKey, null, NEGATIVE_TTL_MS);

package/Server/Services/UserWebhookService.ts

@@ -1,6 +1,7 @@
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import UserNotificationRuleService from "./UserNotificationRuleService";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
@@ -8,8 +9,19 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import Model from "../../Models/DatabaseModels/UserWebhook";
 import URL from "../../Types/API/URL";
 import logger from "../Utils/Logger";
+import SSRFProtection from "../Utils/SSRFProtection";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * URL validation here used to be a hand-rolled copy of the SSRF blocklist that
+ * had drifted weaker than the original (it compared the host with the port
+ * still attached, and never resolved DNS). Everything that actually sends one
+ * of these webhooks goes through WebhookService, which calls
+ * SSRFProtection.validateWebhookTargetIsSafe — so the copy bought nothing and
+ * would have been read as "this is checked". Both hooks now call the same
+ * guard the sender does, which fails the write early instead of at delivery.
+ */
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -27,7 +39,7 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Webhook name is required");
     }
 
-    this.validateWebhookUrl(createBy.data.webhookUrl);
+    await SSRFProtection.validateWebhookTargetIsSafe(createBy.data.webhookUrl);
 
     return {
       createBy,
@@ -35,6 +47,26 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * Create-time validation on its own is not a control: the URL is
+     * editable afterwards.
+     */
+    const webhookUrl: unknown = updateBy.data.webhookUrl;
+
+    if (typeof webhookUrl === "string" || webhookUrl instanceof URL) {
+      await SSRFProtection.validateWebhookTargetIsSafe(webhookUrl);
+    }
+
+    return {
+      updateBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<Model>,
@@ -96,113 +128,6 @@ export class Service extends DatabaseService<Model> {
       carryForward: null,
     };
   }
-
-  private validateWebhookUrl(rawUrl: string): void {
-    let parsed: URL;
-    try {
-      parsed = URL.fromString(rawUrl);
-    } catch {
-      throw new BadDataException("Webhook URL is not a valid URL");
-    }
-
-    const protocolValue: string = parsed.protocol.toString().toLowerCase();
-    if (protocolValue !== "http://" && protocolValue !== "https://") {
-      throw new BadDataException(
-        "Webhook URL must use http or https protocol.",
-      );
-    }
-
-    const hostname: string = parsed.hostname.hostname.toLowerCase();
-
-    if (!hostname) {
-      throw new BadDataException("Webhook URL must include a host.");
-    }
-
-    if (isBlockedHostnameLiteral(hostname)) {
-      throw new BadDataException(
-        "Webhook URL points to a private, loopback, or link-local address and is not allowed.",
-      );
-    }
-  }
-}
-
-function isBlockedHostnameLiteral(hostname: string): boolean {
-  if (
-    hostname === "localhost" ||
-    hostname.endsWith(".localhost") ||
-    hostname === "metadata.google.internal"
-  ) {
-    return true;
-  }
-
-  // IPv4 literal check
-  const ipv4Match: RegExpMatchArray | null = hostname.match(
-    /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
-  );
-  if (ipv4Match) {
-    const octets: Array<number> = [
-      Number(ipv4Match[1]),
-      Number(ipv4Match[2]),
-      Number(ipv4Match[3]),
-      Number(ipv4Match[4]),
-    ];
-
-    if (
-      octets.some((o: number) => {
-        return o < 0 || o > 255;
-      })
-    ) {
-      return true;
-    }
-
-    // 0.0.0.0/8
-    if (octets[0] === 0) {
-      return true;
-    }
-    // 127.0.0.0/8 loopback
-    if (octets[0] === 127) {
-      return true;
-    }
-    // 10.0.0.0/8
-    if (octets[0] === 10) {
-      return true;
-    }
-    // 172.16.0.0/12
-    if (octets[0] === 172 && (octets[1]! & 0xf0) === 16) {
-      return true;
-    }
-    // 192.168.0.0/16
-    if (octets[0] === 192 && octets[1] === 168) {
-      return true;
-    }
-    // 169.254.0.0/16 link-local (incl. cloud metadata)
-    if (octets[0] === 169 && octets[1] === 254) {
-      return true;
-    }
-    // 100.64.0.0/10 carrier-grade NAT
-    if (octets[0] === 100 && (octets[1]! & 0xc0) === 64) {
-      return true;
-    }
-    return false;
-  }
-
-  // IPv6 literal — block loopback, link-local, unique-local
-  if (hostname.includes(":")) {
-    const stripped: string = hostname.replace(/^\[|\]$/g, "");
-    if (stripped === "::1" || stripped === "::") {
-      return true;
-    }
-    if (stripped.startsWith("fe80:") || stripped.startsWith("fe80::")) {
-      return true;
-    }
-    if (IPV6_UNIQUE_LOCAL_REGEX.test(stripped)) {
-      return true;
-    }
-  }
-
-  return false;
 }
 
-const IPV6_UNIQUE_LOCAL_REGEX: RegExp = /^f[cd][0-9a-f]{2}:/;
-
 export default new Service();

package/Server/Services/WorkspaceNotificationRuleService.ts

@@ -309,6 +309,20 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
 
             // Check for errors in the response
             if (res.errors && res.errors.length > 0) {
+              /*
+               * Record the failure before throwing. Test sends used to throw
+               * straight out of here, so a failed test left no trace in
+               * Notification Logs and support had no way to see what Microsoft
+               * or Slack actually said.
+               */
+              await this.logTestSendFailures({
+                projectId: data.projectId,
+                workspaceType: res.workspaceType,
+                errors: res.errors,
+                message: messageSummary,
+                userId: data.testByUserId,
+              });
+
               const errorMessages: Array<string> = res.errors.map(
                 (error: { channel: WorkspaceChannel; error: string }) => {
                   return `Channel ${error.channel.name}: ${error.error}`;
@@ -408,6 +422,20 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
 
             // Check for errors in the response
             if (res.errors && res.errors.length > 0) {
+              /*
+               * Record the failure before throwing. Test sends used to throw
+               * straight out of here, so a failed test left no trace in
+               * Notification Logs and support had no way to see what Microsoft
+               * or Slack actually said.
+               */
+              await this.logTestSendFailures({
+                projectId: data.projectId,
+                workspaceType: res.workspaceType,
+                errors: res.errors,
+                message: messageSummary,
+                userId: data.testByUserId,
+              });
+
               const errorMessages: Array<string> = res.errors.map(
                 (error: { channel: WorkspaceChannel; error: string }) => {
                   return `Channel ${error.channel.name}: ${error.error}`;
@@ -540,6 +568,47 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
     }
   }
 
+  /*
+   * Persist per-destination failures from a test send so they show up in
+   * Settings > Notification Logs alongside real notification failures. Real
+   * sends already log; test sends threw before reaching any logging, which
+   * meant the one action an admin takes to diagnose a broken integration was
+   * also the only one that recorded nothing.
+   *
+   * Best-effort: a logging failure must never mask the underlying send error.
+   */
+  @CaptureSpan()
+  private async logTestSendFailures(data: {
+    projectId: ObjectID;
+    workspaceType: WorkspaceType;
+    errors: Array<{ channel: WorkspaceChannel; error: string }>;
+    message: string;
+    userId: ObjectID;
+  }): Promise<void> {
+    for (const error of data.errors) {
+      try {
+        const log: WorkspaceNotificationLog = new WorkspaceNotificationLog();
+        log.projectId = data.projectId;
+        log.workspaceType = data.workspaceType;
+        log.channelId = error.channel.id;
+        log.channelName = error.channel.name;
+        log.message = data.message;
+        log.status = WorkspaceNotificationStatus.Error;
+        log.statusMessage = error.error;
+        log.userId = data.userId;
+        log.actionType = WorkspaceNotificationActionType.SendMessage;
+
+        await WorkspaceNotificationLogService.create({
+          data: log,
+          props: { isRoot: true },
+        });
+      } catch (err) {
+        logger.error("Could not write test-send failure to notification log:");
+        logger.error(err);
+      }
+    }
+  }
+
   @CaptureSpan()
   public async archiveWorkspaceChannels(data: {
     projectId: ObjectID;

package/Server/Services/WorkspaceProjectAuthTokenService.ts

@@ -1,5 +1,7 @@
 import ObjectID from "../../Types/ObjectID";
-import WorkspaceType from "../../Types/Workspace/WorkspaceType";
+import WorkspaceType, {
+  getWorkspaceTypeDisplayName,
+} from "../../Types/Workspace/WorkspaceType";
 import DatabaseService from "./DatabaseService";
 import Model, {
   WorkspaceMiscData,
@@ -7,6 +9,7 @@ import Model, {
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -112,12 +115,45 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         _id: true,
+        workspaceProjectId: true,
       },
       props: {
         isRoot: true,
       },
     });
 
+    /*
+     * A project stores exactly one workspace (one Microsoft tenant / one Slack
+     * team). Re-running the connect flow from a DIFFERENT workspace used to
+     * silently repoint the project, which breaks every existing notification
+     * rule and orphans the bot conversations captured under the old workspace —
+     * with no error and nothing in the logs.
+     *
+     * Refuse instead, and tell the admin to disconnect first if the change is
+     * deliberate.
+     */
+    if (
+      projectAuth &&
+      projectAuth.workspaceProjectId &&
+      projectAuth.workspaceProjectId !== data.workspaceProjectId
+    ) {
+      logger.error(
+        `Refusing to repoint ${data.workspaceType} for project ${data.projectId.toString()} from workspace ${projectAuth.workspaceProjectId} to ${data.workspaceProjectId}.`,
+        {
+          projectId: data.projectId.toString(),
+          workspaceType: data.workspaceType,
+        },
+      );
+
+      const workspaceName: string = getWorkspaceTypeDisplayName(
+        data.workspaceType,
+      );
+
+      throw new BadDataException(
+        `This OneUptime project is already connected to a different ${workspaceName} workspace. Disconnect the existing ${workspaceName} connection in Project Settings before connecting a new one.`,
+      );
+    }
+
     if (!projectAuth) {
       projectAuth = new Model();
 

package/Server/Types/Database/DeleteById.ts

@@ -5,5 +5,7 @@ import User from "../../../Models/DatabaseModels/User";
 export default interface DeleteById {
   id: ObjectID;
   deletedByUser?: User;
+  // See DeleteOneBy.deletionReason - passed straight through to the hooks.
+  deletionReason?: string | undefined;
   props: DatabaseCommonInteractionProps;
 }

package/Server/Types/Database/DeleteOneBy.ts

@@ -6,5 +6,11 @@ import User from "../../../Models/DatabaseModels/User";
 export default interface DeleteOneBy<TBaseModel extends BaseModel> {
   query: Query<TBaseModel>;
   deletedByUser?: User | undefined;
+  /*
+   * Free-text reason the caller gave for the delete. Never persisted on the
+   * row being deleted (it is about to be gone) - it rides through to the
+   * delete hooks, which are the last place that can record it anywhere.
+   */
+  deletionReason?: string | undefined;
   props: DatabaseCommonInteractionProps;
 }